A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-23 13:09:04 -04:00
Code Issues Projects Releases Packages Wiki Activity

Merge "qcacld-3.0: Add sanity check for buf pkt len to prevent OOB access" into wlan-cld3.driver.lnx.2.0-dev

Browse source
This commit is contained in:
CNSS_WLAN Service 2017-10-14 09:20:25 -07:00 • committed by Gerrit - the friendly Code Review server
commit b070298be6
1 changed files with 13 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

13
core/wma/src/wma_features.c
View file

@ -2514,6 +2514,13 @@ static int wma_wake_event_packet(
return 0;
}
if (packet_len > (event_param->num_wow_packet_buffer - 4)) {
WMA_LOGE("Invalid packet_len from firmware, packet_len: %u, num_wow_packet_buffer: %u",
packet_len,
event_param->num_wow_packet_buffer);
return -EINVAL;
}
wake_info = event_param->fixed_param;
switch (wake_info->wake_reason) {
@ -2600,6 +2607,12 @@ static int wma_wake_event_piggybacked(
/* first 4 bytes are the length, followed by the buffer */
pb_event_len = *(uint32_t *)event_param->wow_packet_buffer;
if (pb_event_len > (event_param->num_wow_packet_buffer - 4)) {
WMA_LOGE("Invalid pb_event_len from firmware, pb_event_len: %u, num_wow_packet_buffer: %u",
pb_event_len,
event_param->num_wow_packet_buffer);
return -EINVAL;
}
pb_event_buf = event_param->wow_packet_buffer + 4;
WMA_LOGD("piggybacked event buffer:");